All vulnerabilities
CVE-2026-98860

Linux: HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8b85ef0f561039e249c3f883c5280a1449c6dbeeAlso 97be6396817bd3b11d06239010d27902940bfaa9, 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027c and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to size_t when compared against size. This causes the negative error code to evaluate as a large positive number, making the (ret > size) condition true.

This silently converts the hardware error into a success return value and copies the unmodified buffer back, which could leave BPF programs operating on uninitialized or stale data.

Fix this by casting size into ssize_t to return the actual negative error code.

Text from CVE List

Affected versions 14

  • Linuxaffected: d6efaa50af62fb0790dd1fd4e7e5506b46312510 before 8b85ef0f561039e249c3f883c5280a1449c6dbeeCVE List
  • Linuxaffected: 73c5b5aea1c443239c8cb4191b4af7a4bd6fd7b1 before 97be6396817bd3b11d06239010d27902940bfaa9CVE List
  • Linuxaffected: 2b658c1c442ec1cd9eec5ead98d68662c40fe645 before f9f808227554b2c116fd07dd2328ecd74ea3f411CVE List
  • Linuxaffected: 2b658c1c442ec1cd9eec5ead98d68662c40fe645 before 3afefbfe55c2a8a0c4bdf6f4cc1f773da120027cCVE List
  • Linuxaffected: eb57dae20fdf6f3069cdc07821fa3bb46de381d7CVE List
  • Linuxaffected: 6.12.78 before 6.12.113CVE List
  • Linuxaffected: 6.18.20 before 6.18.56CVE List
  • Linuxaffected: 6.19.10 before 6.20CVE List
  • Linuxaffected: 7.0CVE List
  • Linuxunaffected: all versions before 7.0CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4